What is the CVSS score of CVE-2026-64737?

CVE-2026-64737 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Apple are affected by CVE-2026-64737?

A sandbox escape vulnerability in macOS (CVE-2026-64737) allows a malicious application with user interaction to break out of its sandbox and access protected data.. A patch is available.

How to fix or mitigate CVE-2026-64737?

Within 24 hours, identify all macOS systems running versions below Sequoia 15.7.8, Sonoma 14.8.8, or Tahoe 26.6 and prioritize patching for high-risk users such as those handling sensitive data. Within 7 days, deploy the vendor-released patch across all affected devices via endpoint management tools and verify successful installation. Within 30 days, audit application sandbox configurations and reinforce user training to avoid running untrusted applications that trigger user interaction prompts.

Apple CVE-2026-64737

EUVD-2026-49462 HIGH

Improper Access Control (CWE-284)

2026-07-27 apple

GHSA-jmvj-wxgc-959r

Authentication Bypass Apple

8.2

CVSS 3.1 · Vendor: apple

Severity by source

Vendor (apple) PRIMARY

8.2 HIGH

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Primary rating from Vendor (apple) · only source for this CVE.

CVSS VectorVendor: apple

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 15:27 vuln.today

CVSS changed

Jul 28, 2026 - 15:22 NVD

8.2 (HIGH)

Patch available

Jul 27, 2026 - 21:17 EUVD

CVE Published

Jul 27, 2026 - 20:15 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 27, 2026 - 20:15 cve.org

HIGH 8.2

DescriptionCVE.org

An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A malicious app may be able to break out of its sandbox.

AnalysisAI

A sandbox escape in macOS allows a malicious application to break out of its sandbox due to an authorization flaw in state management. Fixed in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6, the vulnerability could enable a local app with user interaction to read and modify protected data. No active exploitation or public proof-of-concept code has been identified.